Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #361
Fill in the blanks: Gaia can be configured using the ______ or _____ .
- A . GaiaUI; command line interface
- B . WebUI; Gaia Interface
- C . Command line interface; WebUI
- D . Gaia Interface; GaiaUI
Correct Answer: C
C
Explanation:
Gaia can be configured using the command line interface (CLI) or the WebUI. The CLI is a text-based interface that allows users to enter commands and view responses in a terminal window. The CLI can be accessed through a console connection, an SSH connection, or a Telnet connection. The WebUI is a graphical interface that allows users to configure Gaia settings through a web browser. The WebUI can be accessed by entering the IP address of the Gaia device in the browser’s address bar.
C
Explanation:
Gaia can be configured using the command line interface (CLI) or the WebUI. The CLI is a text-based interface that allows users to enter commands and view responses in a terminal window. The CLI can be accessed through a console connection, an SSH connection, or a Telnet connection. The WebUI is a graphical interface that allows users to configure Gaia settings through a web browser. The WebUI can be accessed by entering the IP address of the Gaia device in the browser’s address bar.
Question #362
SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run.
The default commands are:
- A . ping, traceroute, netstat, and route
- B . ping, nslookup, Telnet, and route
- C . ping, whois, nslookup, and Telnet
- D . ping, traceroute, netstat, and nslookup
Correct Answer: C
C
Explanation:
The default commands that appear when right-clicking the IP address, source or destination, in an
event in SmartEvent are ping, whois, nslookup, and Telnet. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent has a feature that allows administrators to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands that can be executed on the IP address of the active cell. The default commands are ping, whois, nslookup, and Telnet. Ping is a command that tests the connectivity and latency between two hosts by sending packets and measuring the response time. Whois is a command that queries a database for information about the owner and registrar of a domain name or an IP address. Nslookup is a command that queries a DNS server for information about a domain name or an IP address, such as its IP address, name server, mail server, etc. Telnet is a command that establishes a remote connection to another host using the Telnet protocol.
C
Explanation:
The default commands that appear when right-clicking the IP address, source or destination, in an
event in SmartEvent are ping, whois, nslookup, and Telnet. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent has a feature that allows administrators to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands that can be executed on the IP address of the active cell. The default commands are ping, whois, nslookup, and Telnet. Ping is a command that tests the connectivity and latency between two hosts by sending packets and measuring the response time. Whois is a command that queries a database for information about the owner and registrar of a domain name or an IP address. Nslookup is a command that queries a DNS server for information about a domain name or an IP address, such as its IP address, name server, mail server, etc. Telnet is a command that establishes a remote connection to another host using the Telnet protocol.
Question #363
What are the main stages of a policy installation?
- A . Initiation, Conversion and FWD REXEC
- B . Verification, Commit, Installation
- C . Initiation, Conversion and Save
- D . Verification Compilation, Transfer and Commit
Correct Answer: D
D
Explanation:
The main stages of a policy installation are Verification, Compilation, Transfer, and Commit. Verification is the stage where the policy is checked for syntax errors and conflicts. Compilation is the stage where the policy is translated into a binary format that can be executed by the Security Gateway. Transfer is the stage where the policy is sent from the Security Management Server to the Security Gateway. Commit is the stage where the policy is activated on the Security Gateway3.
Reference: Check Point R81 Security Management Guide
D
Explanation:
The main stages of a policy installation are Verification, Compilation, Transfer, and Commit. Verification is the stage where the policy is checked for syntax errors and conflicts. Compilation is the stage where the policy is translated into a binary format that can be executed by the Security Gateway. Transfer is the stage where the policy is sent from the Security Management Server to the Security Gateway. Commit is the stage where the policy is activated on the Security Gateway3.
Reference: Check Point R81 Security Management Guide
Question #364
One of major features in R81 SmartConsole is concurrent administration.
Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?
- A . A lock icon shows that a rule or an object is locked and will be available.
- B . AdminA and AdminB are editing the same rule at the same time.
- C . A lock icon next to a rule informs that any Administrator is working on this particular rule.
- D . AdminA, AdminB and AdminC are editing three different rules at the same time.
Correct Answer: B
B
Explanation:
One of the major features in R81 SmartConsole is concurrent administration. This feature allows multiple administrators to work on the same Security Policy simultaneously, without blocking each other or creating conflicts. Concurrent administration improves the efficiency and productivity of security management operations1.
However, not all of the options given are possible considering that AdminA, AdminB and AdminC are editing the same Security Policy. The correct answer is B) AdminA and AdminB are editing the same rule at the same time. This is not possible because concurrent administration uses a locking mechanism to prevent multiple administrators from modifying the same rule or object at the same time. When an administrator clicks on a rule or an object, it becomes locked and a lock icon appears next to it. The lock icon shows the name of the administrator who is working on that rule or object, and prevents other administrators from editing it until it is unlocked12.
Therefore, the other options are possible considering that AdminA, AdminB and AdminC are editing the same Security Policy. Option A is possible because a lock icon shows that a rule or an object is locked and will be available when the administrator who locked it finishes working on it or logs out of SmartConsole12. Option C is possible because a lock icon next to a rule informs that any administrator is working on this particular rule, and hovering over the lock icon will show the name of that administrator12. Option D is possible because AdminA, AdminB and AdminC are editing three different rules at the same time, which does not create any conflicts or blockages12.
B
Explanation:
One of the major features in R81 SmartConsole is concurrent administration. This feature allows multiple administrators to work on the same Security Policy simultaneously, without blocking each other or creating conflicts. Concurrent administration improves the efficiency and productivity of security management operations1.
However, not all of the options given are possible considering that AdminA, AdminB and AdminC are editing the same Security Policy. The correct answer is B) AdminA and AdminB are editing the same rule at the same time. This is not possible because concurrent administration uses a locking mechanism to prevent multiple administrators from modifying the same rule or object at the same time. When an administrator clicks on a rule or an object, it becomes locked and a lock icon appears next to it. The lock icon shows the name of the administrator who is working on that rule or object, and prevents other administrators from editing it until it is unlocked12.
Therefore, the other options are possible considering that AdminA, AdminB and AdminC are editing the same Security Policy. Option A is possible because a lock icon shows that a rule or an object is locked and will be available when the administrator who locked it finishes working on it or logs out of SmartConsole12. Option C is possible because a lock icon next to a rule informs that any administrator is working on this particular rule, and hovering over the lock icon will show the name of that administrator12. Option D is possible because AdminA, AdminB and AdminC are editing three different rules at the same time, which does not create any conflicts or blockages12.
Question #365
What does the Log "Views" tab show when SmartEvent is Correlating events?
- A . A list of common reports
- B . Reports for customization
- C . Top events with charts and graphs
- D . Details of a selected logs
Correct Answer: D
D
Explanation:
The Log “Views” tab shows the details of a selected log when SmartEvent is correlating events. You can select a log from the Logs tab and click on the Views tab to see more information about the log, such as source, destination, service, action, blade, rule number, etc. You can also customize the columns and filters in the Views tab to display only the relevant fields for your analysis.
Reference: [SmartEvent User Guide]
D
Explanation:
The Log “Views” tab shows the details of a selected log when SmartEvent is correlating events. You can select a log from the Logs tab and click on the Views tab to see more information about the log, such as source, destination, service, action, blade, rule number, etc. You can also customize the columns and filters in the Views tab to display only the relevant fields for your analysis.
Reference: [SmartEvent User Guide]
Question #366
In ClusterXL Load Sharing Multicast Mode:
- A . only the primary member received packets sent to the cluster IP address
- B . only the secondary member receives packets sent to the cluster IP address
- C . packets sent to the cluster IP address are distributed equally between all members of the cluster
- D . every member of the cluster received all of the packets sent to the cluster IP address
Correct Answer: D
D
Explanation:
In ClusterXL Load Sharing Multicast Mode, every member of the cluster receives all of the packets sent to the cluster IP address. This mode uses multicast MAC addresses to distribute packets to all cluster members. Each member decides whether to accept or reject the packet based on a load balancing algorithm. This mode provides better performance and scalability than Unicast mode, but requires a switch that supports multicast MAC addresses.
D
Explanation:
In ClusterXL Load Sharing Multicast Mode, every member of the cluster receives all of the packets sent to the cluster IP address. This mode uses multicast MAC addresses to distribute packets to all cluster members. Each member decides whether to accept or reject the packet based on a load balancing algorithm. This mode provides better performance and scalability than Unicast mode, but requires a switch that supports multicast MAC addresses.
Question #367
What two ordered layers make up the Access Control Policy Layer?
- A . URL Filtering and Network
- B . Network and Threat Prevention
- C . Application Control and URL Filtering
- D . Network and Application Control
Correct Answer: D
D
Explanation:
What two ordered layers make up the Access Control Policy Layer? Network and Application Control are the two ordered layers that make up the Access Control Policy Layer. The Network layer controls network access based on source, destination, service, time, etc. The Application Control layer controls application access based on users, groups, applications, content categories, etc. The Network layer is always processed before the Application Control layer.
Reference: R81 Security Management Administration Guide, page 29.
D
Explanation:
What two ordered layers make up the Access Control Policy Layer? Network and Application Control are the two ordered layers that make up the Access Control Policy Layer. The Network layer controls network access based on source, destination, service, time, etc. The Application Control layer controls application access based on users, groups, applications, content categories, etc. The Network layer is always processed before the Application Control layer.
Reference: R81 Security Management Administration Guide, page 29.
Question #368
Return oriented programming (ROP) exploits are detected by which security blade?
- A . Data Loss Prevention
- B . Check Point Anti-Virus / Threat Emulation
- C . Application control
- D . Intrusion Prevention Software
Correct Answer: B
B
Explanation:
Return-oriented programming (ROP) exploits are detected by Check Point Anti-Virus / Threat Emulation blade. ROP exploits are a type of code reuse attack that bypasses common exploit mitigation techniques such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). Check Point Anti-Virus / Threat Emulation blade can detect and prevent ROP exploits using its behavioral analysis engine that monitors the execution flow of processes and identifies malicious patterns.
Reference: [Check Point Security Expert R81 Threat Prevention Administration Guide], page 17.
B
Explanation:
Return-oriented programming (ROP) exploits are detected by Check Point Anti-Virus / Threat Emulation blade. ROP exploits are a type of code reuse attack that bypasses common exploit mitigation techniques such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). Check Point Anti-Virus / Threat Emulation blade can detect and prevent ROP exploits using its behavioral analysis engine that monitors the execution flow of processes and identifies malicious patterns.
Reference: [Check Point Security Expert R81 Threat Prevention Administration Guide], page 17.
Question #369
Which command collects diagnostic data for analyzing a customer setup remotely?
- A . cpv
- B . cpinfo
- C . migrate export
- D . sysinfo
Correct Answer: B
B
Explanation:
The verified answer is B) cpinfo.
cpinfo is a command that collects diagnostic data for analyzing a customer setup remotely. It is an auto-updatable utility that runs on the customer’s machine and uploads the data to Check Point servers. The data includes information about the system, the security policy, the objects, and the logs. Check Point support engineers can use the DiagnosticsView utility to open the cpinfo file and view the customer’s configuration and environment settings1.
migrate export is a command that exports the Check Point configuration and database files to a compressed file. It is used for backup and migration purposes, not for remote analysis2.
sysinfo is a command that displays basic information about the system, such as the hostname, the OS version, the CPU model, and the memory size. It does not collect or upload any data to Check Point servers3.
cpv is not a valid command in Check Point.
Reference: Support, Support Requests, Training … – Check Point Software1 Migrate export – Check Point Software sysinfo – Check Point Software
B
Explanation:
The verified answer is B) cpinfo.
cpinfo is a command that collects diagnostic data for analyzing a customer setup remotely. It is an auto-updatable utility that runs on the customer’s machine and uploads the data to Check Point servers. The data includes information about the system, the security policy, the objects, and the logs. Check Point support engineers can use the DiagnosticsView utility to open the cpinfo file and view the customer’s configuration and environment settings1.
migrate export is a command that exports the Check Point configuration and database files to a compressed file. It is used for backup and migration purposes, not for remote analysis2.
sysinfo is a command that displays basic information about the system, such as the hostname, the OS version, the CPU model, and the memory size. It does not collect or upload any data to Check Point servers3.
cpv is not a valid command in Check Point.
Reference: Support, Support Requests, Training … – Check Point Software1 Migrate export – Check Point Software sysinfo – Check Point Software
Question #370
Installations and upgrades with CPUSE require that the CPUSE agent is up-to-date. Usually the latest build is downloaded automatically.
How can you verify the CPUSE agent build?
- A . In WebUI Status and Actions page or by running the following command in CLISH: show installer status build
- B . In WebUI Status and Actions page or by running the following command in CLISH: show installer status version
- C . In the Management Server or Gateway object in SmartConsole or by running the following command in CLISH: show installer status build
- D . In the Management Server or Gateway object in SmartConsole or by running the following command in CLISH: show installer agent
Correct Answer: A
A
Explanation:
To verify the CPUSE agent build, you can use either of these methods:
In WebUI Status and Actions page
By running the following command in CLISH: show installer status build The CPUSE agent build indicates the version of the CPUSE agent that is installed on the machine. The CPUSE agent is responsible for downloading, verifying, installing, and removing packages on Gaia OS. It is recommended to keep the CPUSE agent up-to-date to ensure a smooth installation and upgrade process.
Reference: [CPUSE Agent]
A
Explanation:
To verify the CPUSE agent build, you can use either of these methods:
In WebUI Status and Actions page
By running the following command in CLISH: show installer status build The CPUSE agent build indicates the version of the CPUSE agent that is installed on the machine. The CPUSE agent is responsible for downloading, verifying, installing, and removing packages on Gaia OS. It is recommended to keep the CPUSE agent up-to-date to ensure a smooth installation and upgrade process.
Reference: [CPUSE Agent]